1. Field of the Invention
The present invention relates to a computer system, and deals more particularly with methods, systems, computer program products, and methods of doing business by enabling events to automatically and dynamically adapt to capabilities of a management system which is responsible for managing information technology resources in a complex and heterogeneous environment.
2. Description of the Related Art
An event generally comprises a message or notification of a significant status change that has happened in the application program or component generating the event. For example, an event may be generated when a software product is installed, or when an error message occurs during program execution, etc. In general, an event may be generated for any situation for which the application writer wishes to provide event generation code. Providing code to generate event messages or notifications and communicate them to a management system is often called “instrumenting” an application.
Software may be written to transform events in predetermined ways prior to delivering the events to an event management system (hereinafter, “EMS”) which is an integral part of a management system. For example, such software may transform incoming messages into a common event syntax for use by the EMS. Prior art event management systems typically receive events which have been generated by executing application programs, analyze the received events and store them in a repository, and process the events in various ways (such as presenting visible warning messages to system operators, triggering automated execution of code to perform various tasks, and so forth). Some event management systems use a rule-based approach for the analysis and correlation of incoming events, to determine if an automated response has been defined via existing rules, and to fire a defined action in the rules base if so. An example of this type of prior art EMS is the Tivoli Enterprise Console® (“TEC”) product from Tivoli Systems. (“Tivoli Enterprise Console” is a registered trademark of Tivoli Systems Inc.)
Several problems arise with prior art event management systems. First, the event syntax in prior art systems is static and non-extensible. That is, the messages which notify the EMS of the occurrence of an event contain a fixed number of name/value pairs (which are referred to as “slots” in the TEC event architecture) or, equivalently, a fixed number of object properties with corresponding object values in an object-oriented solution. The number of slots or properties in a particular event message, and the information contained therein, depends on the amount of significant data the application writer provided in the event-generation code which he or she wrote in the underlying application. (To a limited extent, additional slots or properties may be added as an event is being transformed for use by the EMS. The TEC system allows a managed organization to define software “event adapters”, which transform incoming events in implementation-specific ways prior to forwarding the events to the EMS. However, such adapter code is written as an interface between the sending application and the EMS, and typically only provides simple reformatting transformations to account for existing capabilities of the EMS.) Often, providing additional data elements from an application on its events requires changing the application instrumentation, which is a time-consuming and costly process. The instrumentation in many application programs is written with either no knowledge of what management features an eventual EMS may provide in the future, or at best a point-in-time understanding of such features. Thus, the information provided by generated events often does not take full advantage of the capabilities which may be available in the EMS when the event is received.
Another problem with prior art event management systems is that the rules in the rule base are predefined and therefore static. New rules can typically be added to the rule base at any time, but just as re-instrumenting the application programs is time-consuming and expensive, adding new rules is also a labor-intensive and often error-prone task, as the person defining the new rules must take care not to disrupt the functioning of any existing rules and must ensure that the revised rule base functions properly. The practical result is that the rule base tends to stay fixed for long periods of time, and thus the rule base is often limited in its ability to provide the best actions that could be provided based upon the latest capabilities of the EMS.
Accordingly, what is needed is a technique that avoids the limitations of prior art event management systems.